The PyPI package tpu-raiden-jax version 99.99.0 contains malicious code that exfiltrates environment variables and system information upon import. It sends the entire environment variables dictionary along with the hostname to a suspicious external URL unrelated to any legitimate publisher. This behavior is consistent with a dependency confusion attack aiming to steal secrets such as AWS credentials, GitHub tokens, and other sensitive environment variables. No official patch or remediation is currently documented.